CVE-2024-26715

Summary

CVE-2024-26715 is a newly identified vulnerability in the Linux kernel's USB subsystem, specifically in the dwc3 gadget driver. In certain scenarios where devices are continuously plugged in and out, a NULL pointer dereference may occur during the suspension and resumption of USB gadgets. This issue arises due to a misalignment between CPU1 and CPU2, where CPU1 clears the gadget driver variable before CPU2 checks it during the suspension process. As a result, CPU2 encounters a NULL pointer dereference, potentially leading to system instability or crashes. The vulnerability has been resolved in the latest kernel updates.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.